kubernetes群集中具有TLS的Hyperledger对等方不断抛出TLS握手错误

以下是对等日志：

2019-12-06 07:00:31.121 UTC [core.comm] ServerHandshake -> ERRO fa975 TLS handshake failed with error EOF server=ChaincodeServer remoteaddress=192.168.131.215:25731
2019-12-06 07:00:31.215 UTC [core.comm] ServerHandshake -> ERRO fa976 TLS handshake failed with error EOF server=ChaincodeServer remoteaddress=192.168.131.215:20784
2019-12-06 07:00:31.301 UTC [core.comm] ServerHandshake -> ERRO fa977 TLS handshake failed with error EOF server=PeerServer remoteaddress=192.168.131.215:8059
2019-12-06 07:00:31.512 UTC [core.comm] ServerHandshake -> ERRO fa978 TLS handshake failed with error EOF server=ChaincodeServer remoteaddress=192.168.163.185:46359
2019-12-06 07:00:31.768 UTC [core.comm] ServerHandshake -> ERRO fa979 TLS handshake failed with error EOF server=PeerServer remoteaddress=192.168.131.215:34603

一切正常。我们可以在链码上进行交易。 有谁能在这个问题上帮助我们吗

编辑日期：2019年12月9日

下面是对等部署yaml文件

apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: korg60
  name: peer1-korg60
spec:
  replicas: 1
  strategy: {}
  selector:
    matchLabels:
       app: hyperledger
       role: peer
       org: korg60
       name: peer1-korg60
  template:
    metadata:
      labels:
       app: hyperledger
       role: peer
       org: korg60
       name: peer1-korg60
    spec:
     containers:
       - name: couchdb
         image: hyperledger/fabric-couchdb:latest
         ports:
          - containerPort: 5984
       - name: peer1-korg60
         image: hyperledger/fabric-peer:1.4
         env:
          - name: FABRIC_CA_CLIENT_HOME
            value: /opt/gopath/src/github.com/hyperledger/fabric/peer
          - name: FABRIC_CA_CLIENT_TLS_CERTFILES
            value: /data/korg60-ca-chain.pem
          - name: ENROLLMENT_URL
            value: http://peer1:peer1pw@ica-korg60.korg60:7054
          - name: PEER_NAME
            value: peer1-korg60
          - name: PEER_HOME
            value: /opt/gopath/src/github.com/hyperledger/fabric/peer
          - name: PEER_HOST
            value: some.domain.com:7051
          - name: PEER_NAME_PASS
            value: peer1:peer1pw
          - name: CORE_PEER_ADDRESSAUTODETECT
            value: "true"
          - name: CORE_PEER_ID
            value: peer1-korg60
          - name: CORE_PEER_ADDRESS
            value: some.domain.com:7051
          - name: CORE_PEER_LOCALMSPID
            value: korg60MSP
          - name: CORE_PEER_MSPCONFIGPATH
            value: /opt/gopath/src/github.com/hyperledger/fabric/peer/msp
          - name: CORE_VM_ENDPOINT
            value: unix:///host/var/run/docker.sock
          - name: CORE_VM_DOCKER_ATTACHSTDOUT
            value: "true"
          - name: FABRIC_LOGGING_SPEC
            value: "peer=INFO"
          - name: CORE_PEER_TLS_ENABLED
            value: "true"
          - name: CORE_PEER_TLS_CERT_FILE
            value: /opt/gopath/src/github.com/hyperledger/fabric/peer/tls/server.crt
          - name: CORE_PEER_TLS_KEY_FILE
            value: /opt/gopath/src/github.com/hyperledger/fabric/peer/tls/server.key
          - name: CORE_PEER_TLS_ROOTCERT_FILE
            value: /data/korg60-ca-chain.pem
          - name: CORE_PEER_TLS_CLIENTAUTHREQUIRED
            value: "false"
          - name: CORE_PEER_TLS_CLIENTROOTCAS_FILES
            value: /data/korg60-ca-chain.pem
          - name: CORE_PEER_TLS_CLIENTCERT_FILE
            value: /data/tls/peer1-korg60-client.crt
          - name: CORE_PEER_TLS_CLIENTKEY_FILE
            value: /data/tls/peer1-korg60-client.key
          - name: CORE_PEER_GOSSIP_USELEADERELECTION
            value: "true"
          - name: CORE_PEER_GOSSIP_ORGLEADER
            value: "false"
          - name: CORE_PEER_GOSSIP_EXTERNALENDPOINT
            value: some.domain.com:7051
          - name: CORE_PEER_GOSSIP_SKIPHANDSHAKE
            value: "true"
          - name: CORE_PEER_CHAINCODELISTENADDRESS
            value: 0.0.0.0:7052
          - name: CORE_LEDGER_STATE_STATEDATABASE
            value: CouchDB
          - name: CORE_LEDGER_STATE_COUCHDBCONFIG_COUCHDBADDRESS
            value: localhost:5984
          - name: ORG
            value: korg60
          - name: ORG_ADMIN_CERT
            value: /data/orgs/korg60/msp/admincerts/cert.pem
          - name: GODEBUG
            value: "netdns=go"
         ports:
          - containerPort: 7051
          - containerPort: 7052
          - containerPort: 7053
         command: ["sh"]
         args:  ["-c", "/scripts/start-peer.sh 2>&1"]
         volumeMounts:
          - mountPath: /scripts
            name: rca-scripts
          - mountPath: /data
            name: rca-data
          - mountPath: /host/var/run/
            name: run
     volumes:
       - name: rca-scripts
         persistentVolumeClaim:
             claimName: rca-scripts-korg60-pvc
       - name: rca-data
         persistentVolumeClaim:
             claimName: rca-data-korg60-pvc
       - name: run
         hostPath:
           path: /run

---
apiVersion: v1
kind: Service
metadata:
  namespace: korg60
  name: peer1-korg60
spec:
 selector:
   app: hyperledger
   role: peer
   org: korg60
   name: peer1-korg60
 type: NodePort
 ports:
   - name: endpoint
     protocol: TCP
     port: 7051
     targetPort: 7051
     nodePort: 30401
   - name: endpoint-chaincode
     protocol: TCP
     port: 7052
     targetPort: 7052
     nodePort: 30402

下面是Order yaml文件

apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: koinearth
  name: orderer1-koinearth
spec:
  replicas: 1
  strategy: {}
  selector:
    matchLabels:
       app: hyperledger
       role: orderer
       org: koinearth
       name: orderer1-koinearth
  template:
    metadata:
      labels:
       app: hyperledger
       role: orderer
       org: koinearth
       name: orderer1-koinearth
    spec:
     containers:
       - name: orderer1-koinearth
         image: hyperledger/fabric-orderer:1.4
         env:
          - name: FABRIC_CA_CLIENT_HOME
            value: /etc/hyperledger/orderer
          - name: FABRIC_CA_CLIENT_TLS_CERTFILES
            value: /data/koinearth-ca-chain.pem
          - name: FABRIC_LOGGING_SPEC
            value: "peer=INFO"
          - name: ENROLLMENT_URL
            value: http://orderer1:orderer1pw@ica-koinearth.koinearth:7054
          - name: ORDERER_HOME
            value: /etc/hyperledger/orderer
          - name: ORDERER_HOST
            value: orderer1-koinearth.koinearth
          - name: ORDERER_GENERAL_LISTENADDRESS
            value: 0.0.0.0
          - name: ORDERER_GENERAL_GENESISMETHOD
            value: file
          - name: ORDERER_GENERAL_GENESISFILE
            value: /data/genesis.block
          - name: ORDERER_GENERAL_LOCALMSPID
            value: koinearthMSP
          - name: ORDERER_GENERAL_LOCALMSPDIR
            value: /etc/hyperledger/orderer/msp
          - name: ORDERER_GENERAL_TLS_ENABLED
            value: "true"
          - name: ORDERER_GENERAL_TLS_CLIENTAUTHREQUIRED
            value: "false"
          - name: ORDERER_GENERAL_TLS_PRIVATEKEY
            value: /etc/hyperledger/orderer/tls/server.key
          - name: ORDERER_GENERAL_TLS_CERTIFICATE
            value: /etc/hyperledger/orderer/tls/server.crt
          - name: ORDERER_GENERAL_LOGLEVEL
            value: debug
          - name: ORDERER_DEBUG_BROADCASTTRACEDIR
            value: data/logs
          - name: ORG
            value: koinearth
          - name: ORG_ADMIN_CERT
            value: /data/orgs/koinearth/msp/admincerts/cert.pem
          - name: ORDERER_GENERAL_TLS_ROOTCAS
            value: '[/data/koinearth-ca-chain.pem]'
          - name: ORDERER_GENERAL_TLS_CLIENTROOTCAS
            value: '[/data/koinearth-ca-chain.pem]'
          - name: ORDERER_KAFKA_VERBOSE
            value: "true"
          - name: ORDERER_KAFKA_VERSION
            value: 1.0.0
          - name: GODEBUG
            value: "netdns=go"
         ports:
          - containerPort: 7050
         command: ["sh"]
         args:  ["-c", "/scripts/start-orderer.sh 2>&1"]
         volumeMounts:
          - mountPath: /etc/hyperledger/fabric-ca
            name: orderer
          - mountPath: /scripts
            name: rca-scripts
          - mountPath: /data
            name: rca-data
     volumes:
       - name: orderer
         persistentVolumeClaim:
             claimName: orderer-koinearth-pvc
       - name: rca-scripts
         persistentVolumeClaim:
             claimName: rca-scripts-koinearth-pvc
       - name: rca-data
         persistentVolumeClaim:
             claimName: rca-data-koinearth-pvc

---
apiVersion: v1
kind: Service
metadata:
  namespace: koinearth
  name: orderer1-koinearth
spec:
 selector:
   app: hyperledger
   role: orderer
   org: koinearth
   name: orderer1-koinearth
 type: NodePort
 ports:
   - name: endpoint
     protocol: TCP
     port: 7050
     targetPort: 7050
     nodePort: 30300

---

对等方和订购方标识在启动脚本中创建，并本地存储在容器中

使用错误的证书时会发生这种情况

双方是什么？ 2个对等方还是1个对等方1个订购方？ 或者是客户

---

双方必须拥有有效的TLS证书，这里您使用了一些错误的证书。

当您使用错误的证书时，会发生这种情况

双方是什么？ 2个对等方还是1个对等方1个订购方？ 或者是客户

---

双方必须拥有有效的TLS证书，这里您使用了一些错误的证书。

这似乎不是k8s问题。验证作为TLS证书的身份。向我们提供对等方、订购方部署清单的完整详细信息，以及您如何生成工件，因为TLS错误更多，所以TLS错误无法识别generic@NarendranathReddy我已经用您询问的信息更新了问题。这似乎不是k8s问题。验证作为TLS证书的身份。向我们提供对等方、订购方部署清单的完整详细信息，以及您如何生成工件，因为TLS错误更多，所以TLS错误无法识别generic@NarendranathReddy我已使用您询问的信息更新了问题。此设置有2个RG，每个RG有2个对等方，3个订购方客户端是我们的node.js应用程序。但我认为客户端没有这个问题，因为我们的应用程序能够完成所有事务。调用getNetwork（）时会发生这种情况吗？我也面临NodeSDK的问题，它似乎有一些与TLS相关的问题。请检查此处：由于这个原因，我现在正在迁移到Java SDK。不，在通过nodeJS客户端调用时不会发生这种情况。对等方正在持续记录此错误。docker设置中不会发生同样的情况。与Kubernetes有一些连接。此设置有2个RG，每个RG有2个对等方，3个订购方（一个带有TLS）。客户端是我们的node.js应用程序。但我认为客户端没有这个问题，因为我们的应用程序能够完成所有事务。调用getNetwork（）时是否会发生这种情况？我也面临NodeSDK的问题，它似乎有一些与TLS相关的问题。请检查此处：由于这个原因，我现在正在迁移到Java SDK。不，在通过nodeJS客户端调用时不会发生这种情况。对等方正在持续记录此错误。docker设置中不会发生同样的情况。与Kubernetes存在一些连接。